KIEM Tech Spec

Tech Spec

This is how the flow of code will looke like

a

Getting the data (Query)

Right now the program will use the k8s api twice

1) to get all the roles

2) to get the role bindings

3) the role binding will be associated with either

• Service account
• User
• Group

user and groups are managed by platform which can be accessed by kubernetes authentication system how to get the user/ group name is yet to be figured out

how does the authentication server know what Kubernetes groups a user is a part of?

AWS MAPPING to

AZURE

Example of Struct

type PermissionTable struct {
    Name      string `json:"name"`
    Kind      string `json:"kind"`
    Namespace string `json:"namespace,omitempty"`
    RoleBindingInfo        []RoleBindingInfo     `json:"RoleBindingInfo"`

}

type RoleBindingInfo struct {
    Namespace       string            `json:"namespace"`
    RoleBindingName string            `json:"role_binding_name"`
	  Name            string       `json:"rolename"`
    Rules           []RoleRuleInfo    `json:"rules"`
}

type RoleRuleInfo struct {
    APIGroups []string `json:"api_groups"`
    Resources []string `json:"resources"`
    Verbs     []string `json:"verbs"`
}

Example of json

[
  {
    "name": "something",
    "kind": "group",
    "namespace": "namespace",
    "RoleBindingInfo": [
      {
        "namespace": "namespace",
        "role_binding_name": "app-dev",
        "role_name" : "Dev-Team"
        "rules": [
          {
            "api_groups": [
              "kubearmor.io"
            ],
            "resources": [
              "kubearmorsecuritypolicy",
              "kubearmorhostpolicy"
            ],
            "verbs": [
              "list",
              "update",
              "add",
              "delete"
            ]
          },
          {
            "api_groups": [
              "cilium.io"
            ],
            "resources": [
              "ciliumsecuritypolicy",
              "ciliumhostpolicy"
            ],
            "verbs": [
              "get",
              "list",
              "add",
              "delete"
            ]
          }
        ]
      }
    ]
  }
]